Statement of Applicability (SoA)
A document that maps every control from a reference framework to your organization, recording which controls apply, which do not, and the justification for each decision. A core deliverable in ISO 27001 certification.
Why it matters
The SoA is the bridge between a generic framework and your specific security posture. Auditors use it to verify that you have consciously considered every control, not just cherry-picked the easy ones. Without a well-maintained SoA, certification audits stall and internal reviews lack structure.
In practice
Building an SoA means walking through each control in your chosen framework (for example, ISO 27001 Annex A) and documenting applicability, implementation status, and rationale. In vucavoid, baselines automate this process. You select a framework, the platform generates the full control set, and you mark applicability per control. Changes are tracked, and the baseline stays linked to the requirements it fulfills.